Disk cloning is the process of making an image of a partition or of an entire hard drive. This can be useful for copying the drive to other computers and for [[backup]] and [[File recovery|recovery]] purposes.

Disk cloning is the process of making an image of a partition or of an entire hard drive. This can be useful for copying the drive to other computers and for [[backup]] and [[File recovery|recovery]] purposes.

Line 14:

Line 20:

{{Warning|As with any command of this type, you should be very cautious when using it; it can destroy data. Remember the order of input file ({{ic|1=if=}}) and output file ({{ic|1=of=}}) and do not reverse them! Always ensure that the destination drive or partition ({{ic|1=of=}}) is of equal or greater size than the source ({{ic|1=if=}}).

{{Warning|As with any command of this type, you should be very cautious when using it; it can destroy data. Remember the order of input file ({{ic|1=if=}}) and output file ({{ic|1=of=}}) and do not reverse them! Always ensure that the destination drive or partition ({{ic|1=of=}}) is of equal or greater size than the source ({{ic|1=if=}}).

This will clone the entire drive, including the MBR (and therefore bootloader), all partitions, UUIDs, and data.

This will clone the entire drive, including the MBR (and therefore bootloader), all partitions, UUIDs, and data.

+

* {{ic|1=bs=}} sets the block size. Defaults to 512 bytes, which is the "classic" block size for hard drives since the early 1980s, but is not the most convenient. Use a bigger value, 64K or 128K. Also, please read the warning below, because there is more to this than just "block sizes" -it also influences how read errors propagate. See [http://www.mail-archive.com/eug-lug@efn.org/msg12073.html] and [http://blog.tdg5.com/tuning-dd-block-size/] for details and to figure out the best bs value for your use case.

* {{ic|noerror}} instructs ''dd'' to continue operation, ignoring all read errors. Default behavior for ''dd'' is to halt at any error.

* {{ic|noerror}} instructs ''dd'' to continue operation, ignoring all read errors. Default behavior for ''dd'' is to halt at any error.

* {{ic|sync}} fills input blocks with zeroes if there were any read errors, so data offsets stay in sync.

* {{ic|sync}} fills input blocks with zeroes if there were any read errors, so data offsets stay in sync.

−

* {{ic|1=bs=}} sets the block size. Defaults to 512 bytes, which is the "classic" block size for hard drives since the early 1980s, but is not the most convenient. Use a bigger value, 64K or 128K. Also, please read the warning below, because there is more to this than just "block sizes" -it also influences how read errors propagate.

+

* {{ic|1=status=progress}} shows periodic transfer statistics which can be used to estimate when the operation may be complete.

The ''dd'' utility technically has an "input block size" (IBS) and an "output block size" (OBS). When you set {{ic|bs}}, you effectively set both IBS and OBS. Normally, if your block size is, say, 1 Mib, ''dd'' will read 1024*1024 bytes and write as many bytes. But if a read error occurs, things will go wrong. Many people seem to think that ''dd'' will "fill up read errors with zeroes" if you use the {{ic|noerror,sync}} options, but this is not what happens. ''dd'' will, according to documentation, fill up the OBS to IBS size ''after completing its read'', which means adding zeroes at the ''end'' of the block. This means, for a disk, that effectively the whole 1 Mib would become messed up because of a single 512 byte read error in the beginning of the read: 12ERROR89 would become 128900000 instead of 120000089.

+

The ''dd'' utility technically has an "input block size" (IBS) and an "output block size" (OBS). When you set {{ic|bs}}, you effectively set both IBS and OBS. Normally, if your block size is, say, 1 MiB, ''dd'' will read 1024*1024 bytes and write as many bytes. But if a read error occurs, things will go wrong. Many people seem to think that ''dd'' will "fill up read errors with zeroes" if you use the {{ic|noerror,sync}} options, but this is not what happens. ''dd'' will, according to documentation, fill up the OBS to IBS size ''after completing its read'', which means adding zeroes at the ''end'' of the block. This means, for a disk, that effectively the whole 1 MiB would become messed up because of a single 512 byte read error in the beginning of the read: 12ERROR89 would become 128900000 instead of 120000089.

If you are positive that your disk does not contain any errors, you could proceed using a larger block size, which will increase the speed of your copying several fold. For example, changing bs from 512 to 64K changed copying speed from 35 MB/s to 120 MB/s on a simple Celeron 2.7 GHz system. But keep in mind that read errors on the source disk will end up as ''block errors'' on the destination disk, i.e. a single 512-byte read error will mess up the whole 64 KiB output block.

If you are positive that your disk does not contain any errors, you could proceed using a larger block size, which will increase the speed of your copying several fold. For example, changing bs from 512 to 64K changed copying speed from 35 MB/s to 120 MB/s on a simple Celeron 2.7 GHz system. But keep in mind that read errors on the source disk will end up as ''block errors'' on the destination disk, i.e. a single 512-byte read error will mess up the whole 64 KiB output block.

Line 45:

Line 54:

}}

}}

−

=== Backing up the MBR ===

+

=== Backing up the partition table ===

−

−

The MBR is stored in the the first 512 bytes of the disk. It consist of 3 parts:

−

−

# The first 446 bytes contain the boot loader.

−

# The next 64 bytes contain the partition table (4 entries of 16 bytes each, one entry for each primary partition).

−

# The last 2 bytes contain an identifier

−

−

To save the MBR as {{ic|mbr.img}}:

−

# dd if=/dev/sdX of=/path/to/mbr_file.img bs=512 count=1

−

−

To restore (be careful: this could destroy your existing partition table and with it access to all data on the disk):

−

# dd if=/path/to/mbr_file.img of=/dev/sdX

−

−

If you only want to restore the boot loader, but not the primary partition table entries, just restore the first 446 bytes of the MBR:

−

# dd if=/path/to/mbr_file.img of=/dev/sdX bs=446 count=1

−

To restore only the partition table, one must use:

+

See [[fdisk#Backup and restore partition table]].

−

# dd if=/path/to/mbr_file.img of=/dev/sdX bs=1 skip=446 count=64

−

−

You can also get the MBR from a full dd disk image:

−

# dd if=/path/to/disk.img of=/path/to/mbr_file.img bs=512 count=1

=== Create disk image ===

=== Create disk image ===

Line 91:

Line 81:

# fdisk -l /dev/sd''X'' > ''/path/to/list_fdisk.info''

# fdisk -l /dev/sd''X'' > ''/path/to/list_fdisk.info''

−

{{Note|You may wish to use a block size ({{ic|1=bs=}}) that is equal to the amount of cache on the HD you are backing up. For example, {{ic|1=bs=8192K}} works for an 8 MiB cache. The 64 Kib mentioned in this article is better than the default {{ic|1=bs=512}} bytes, but it will run faster with a larger {{ic|1=bs=}}.}}

+

{{Note|You may wish to use a block size ({{ic|1=bs=}}) that is equal to the amount of cache on the HD you are backing up. For example, {{ic|1=bs=8192K}} works for an 8 MiB cache. The 64 KiB mentioned in this article is better than the default {{ic|1=bs=512}} bytes, but it will run faster with a larger {{ic|1=bs=}}.}}

=== Restore system ===

=== Restore system ===

Line 100:

Line 90:

When the image has been split, use the following instead:

When the image has been split, use the following instead:

# cat ''/path/to/backup.img.gz*'' | gunzip -c | dd of=/dev/sd''X''

# cat ''/path/to/backup.img.gz*'' | gunzip -c | dd of=/dev/sd''X''

+

+

== Using ddrescue ==

+

''ddrescue'' is a tool designed for cloning and recovering data. It copies data from one file or block device (hard disc, cdrom, etc) to another, trying to rescue the good parts first in case of read errors, to maximize the recovered data.

+

+

To clone a faulty or dying drive, run ddrescue twice. First round, copy every block without read error and log the errors to rescue.log.

+

+

# ddrescue -f -n /dev/sdX /dev/sdY rescue.log

+

+

Second round, copy only the bad blocks and try 3 times to read from the source before giving up.

+

+

# ddrescue -d -f -r3 /dev/sdX /dev/sdY rescue.log

+

+

Now you can check the file system for corruption and mount the new drive.

+

+

# fsck -f /dev/sdY

+

+

== Using e2image ==

+

+

''e2image'' is a tool included in {{Pkg|e2fsprogs}} for debugging purposes. It can be used to copy ext2, ext3, and ext4 partitions efficiently by only copying the used blocks. Note that this only works for ext2, ext3, and ext4 filesystems, and the unused blocks are not copied so this may not be a useful tool if one is hoping to recover deleted files.

+

+

To clone a partition from physical disk {{ic|/dev/sda}}, partition 1, to physical disk {{ic|/dev/sdb}}, partition 1 with e2image, run

; dcfldd : {{Pkg|dcfldd}} is an enhanced version of dd with features useful for forensics and security. It accepts most of dd's parameters and includes status output. The last stable version of dcfldd was released on December 19, 2006.<sup>[http://dcfldd.sourceforge.net/]</sup>

+

+

; ddrescue : GNU {{Pkg|ddrescue}} is a data recovery tool. It is capable of ignoring read errors, which is a useless feature for disk wiping in almost any case. See the [http://www.gnu.org/software/ddrescue/manual/ddrescue_manual.html official manual] for details.

Using dd

The dd command is a simple, yet versatile and powerful tool. It can be used to copy from source to destination, block-by-block, regardless of their filesystem types or operating systems. A convenient method is to use dd from a live environment, as in a Live CD.

Warning: As with any command of this type, you should be very cautious when using it; it can destroy data. Remember the order of input file (if=) and output file (of=) and do not reverse them! Always ensure that the destination drive or partition (of=) is of equal or greater size than the source (if=).

Cloning a partition

Warning: If output file of= (sdb1 in the example) does not exist, dd will create a file with this name and will start filling up your root file system!

Cloning an entire hard disk

From physical disk /dev/sdX to physical disk /dev/sdY

# dd if=/dev/sdX of=/dev/sdY bs=64K conv=noerror,sync status=progress

This will clone the entire drive, including the MBR (and therefore bootloader), all partitions, UUIDs, and data.

bs= sets the block size. Defaults to 512 bytes, which is the "classic" block size for hard drives since the early 1980s, but is not the most convenient. Use a bigger value, 64K or 128K. Also, please read the warning below, because there is more to this than just "block sizes" -it also influences how read errors propagate. See [1] and [2] for details and to figure out the best bs value for your use case.

noerror instructs dd to continue operation, ignoring all read errors. Default behavior for dd is to halt at any error.

sync fills input blocks with zeroes if there were any read errors, so data offsets stay in sync.

status=progress shows periodic transfer statistics which can be used to estimate when the operation may be complete.

Warning: The block size you specify influences how read errors are handled. Read below. For data recovery, use ddrescue.

The dd utility technically has an "input block size" (IBS) and an "output block size" (OBS). When you set bs, you effectively set both IBS and OBS. Normally, if your block size is, say, 1 MiB, dd will read 1024*1024 bytes and write as many bytes. But if a read error occurs, things will go wrong. Many people seem to think that dd will "fill up read errors with zeroes" if you use the noerror,sync options, but this is not what happens. dd will, according to documentation, fill up the OBS to IBS size after completing its read, which means adding zeroes at the end of the block. This means, for a disk, that effectively the whole 1 MiB would become messed up because of a single 512 byte read error in the beginning of the read: 12ERROR89 would become 128900000 instead of 120000089.

If you are positive that your disk does not contain any errors, you could proceed using a larger block size, which will increase the speed of your copying several fold. For example, changing bs from 512 to 64K changed copying speed from 35 MB/s to 120 MB/s on a simple Celeron 2.7 GHz system. But keep in mind that read errors on the source disk will end up as block errors on the destination disk, i.e. a single 512-byte read error will mess up the whole 64 KiB output block.

Tip: If you would like to view dd progressing, use the status=progress option. See dd for details.

Note:

To regain unique UUIDs of an ext2/3/4 filesystem, use tune2fs /dev/sdXY -U random on every partition.

Partition table changes from dd are not registered by the kernel. To notify of changes without rebooting, use a utility like partprobe (part of GNU Parted).

5. Save extra information about the drive geometry necessary in order to interpret the partition table stored within the image. The most important of which is the cylinder size.

# fdisk -l /dev/sdX > /path/to/list_fdisk.info

Note: You may wish to use a block size (bs=) that is equal to the amount of cache on the HD you are backing up. For example, bs=8192K works for an 8 MiB cache. The 64 KiB mentioned in this article is better than the default bs=512 bytes, but it will run faster with a larger bs=.

Restore system

To restore your system:

# gunzip -c /path/to/backup.img.gz | dd of=/dev/sdX

When the image has been split, use the following instead:

# cat /path/to/backup.img.gz* | gunzip -c | dd of=/dev/sdX

Using ddrescue

ddrescue is a tool designed for cloning and recovering data. It copies data from one file or block device (hard disc, cdrom, etc) to another, trying to rescue the good parts first in case of read errors, to maximize the recovered data.

To clone a faulty or dying drive, run ddrescue twice. First round, copy every block without read error and log the errors to rescue.log.

# ddrescue -f -n /dev/sdX /dev/sdY rescue.log

Second round, copy only the bad blocks and try 3 times to read from the source before giving up.

# ddrescue -d -f -r3 /dev/sdX /dev/sdY rescue.log

Now you can check the file system for corruption and mount the new drive.

# fsck -f /dev/sdY

Using e2image

e2image is a tool included in e2fsprogs for debugging purposes. It can be used to copy ext2, ext3, and ext4 partitions efficiently by only copying the used blocks. Note that this only works for ext2, ext3, and ext4 filesystems, and the unused blocks are not copied so this may not be a useful tool if one is hoping to recover deleted files.

To clone a partition from physical disk /dev/sda, partition 1, to physical disk /dev/sdb, partition 1 with e2image, run

# e2image -ra -p /dev/sda1 /dev/sdb1

Note: gparted uses e2image to efficiently copy ext2/3/4 partitions.

Disk cloning software

These applications allow easy backup of entire filesystems and recovery in case of failure, usually in the form of a Live CD or USB drive. They contain complete system images from one or more specific points in time and are frequently used to record known good configurations.

Acronis True Image — Commercial disk cloner for Windows. It allows you to create a live (from within Windows), so you do not need a working Windows install on the actual machine to use it. After registration of the Acronis software on their website, you will be able to download a Linux-based Live CD and/or plugins for BartPE for creation of the Windows-based live CD. It can also create a WinPE Live CD based on Windows. The created ISO Live CD image by Acronis doesn't have the hybrid boot ability and cannot be written to USB storage as a raw file.

dd spin-offs

dcfldd is an enhanced version of dd with features useful for forensics and security. It accepts most of dd's parameters and includes status output. The last stable version of dcfldd was released on December 19, 2006.[3]

ddrescue

GNU ddrescue is a data recovery tool. It is capable of ignoring read errors, which is a useless feature for disk wiping in almost any case. See the official manual for details.